What passed, what failed, and what is still only a bet.

Current unreleased main · 2026-08-03

Pull request #10 is merged into main at 91123ca. The current packaged release remains v1.1.0. The source gate below ran on tested head 156166f; the merge commit has the same source tree.

The relevance failure had two causes: common instruction words survived lexical tokenization, and weak dense candidates were admitted below a useful semantic-similarity floor. Current main expands the stopword set, requires stronger dense scores, and keeps an honest empty packet when neither retrieval lane has adequate evidence.

The same merged tree includes exact-locator lookup, dot-free MCP names for clients that rewrite tool identifiers, evidence-only source-history ingestion, sparse-wiki freshness markers, corpus-aware vector freshness, bounded writer locks, and one-shot Transport closed recovery. Those behaviors have source and test evidence on main; fresh model-driven multi-client acceptance and release assets remain separate gates.

Environment-verified v1 snapshot · 2026-07-13

This is the verified source, migration, and fresh-client acceptance state on one machine on one date. The version numbers are evidence about that run rather than a promise that they will always be the latest releases.

The July 10 proof remains historical evidence for the v0.4 brain.search surface. On July 13, fresh Codex, Claude Code, and OpenClaw processes separately completed context → source → feedback → closeout against the same v1.0.1 live core. All three source expansions were hash-verified, all three context retrievals were marked helpful, and all three verified closeouts landed in that database.

The acceptance also found a stale pre-v1 Runtime Integration source preserved by migration. The current file was re-imported as project-scoped evidence, both serving legacy duplicates were retracted by append-only correction events, and a post-correction context/source check returned the new belief with a verified hash. OpenClaw's final acceptance used that refreshed source.

The current source fails closed at the expensive boundaries.

The lock-window result matters.

A previous implementation let retrieval-audit logging turn a successful read into database is locked. The current path separates the two outcomes. Search still returns scoped context, while the response says retrieval_use_status=database_busy and omits the feedback handle.

An earlier Claude acceptance hit that exact condition. Claude used the successful read and did not retry merely to manufacture an audit id. That remains a passed concurrency behavior, not a feedback record; the later Opus 4.8 acceptance completed both search and recorded feedback.

The release audit found five forms of the same mistake: one dataset transaction stayed open across 3,712.6 seconds of parsing, autolabel kept signal writes open across FTS searches, review held its first write while the lazy iterator parsed later transcripts, hosted judge/embedding calls waited on TLS after writing their audits, and persona preparation still ran after acquiring the writer. v0.3.2 bounds those paths and keeps parsing, quality work, and network I/O outside SQLite transactions. After the original live writer exited, a safe checkpoint reduced the WAL from 625,436,632 bytes to zero.

Historically, the passive stall watcher followed the same boundary: deadman evidence committed before optional Telegram paging, and delivery state was recorded afterward. v0.4.1 retired its schedule; watchdog diagnostics now live in the optional ocbrain-ops companion and still install no recurring job.

Historical v0.3.1 probes allowed 39 of 40 writer attempts during review and 40 of 40 during tripwires and promotion. The later heavy ledger exposed a 27.457-second persona hold, so v0.3.2 moved redaction, serialization, quality scoring, and dedup reads outside the transaction. Post-fix stress runs measured a 0.001128-second maximum across 200 large persona examples and 0.000863 seconds across one 200-tool-turn review session.

The v0.3.3 live audit verified the complete 306,974-event hash chain and reproduced all 101,641 projected beliefs byte-for-byte. It repaired five legacy foreign-key references without deleting their retrieval history, removed 5,202 parentless FTS rows, and left both checks at zero. A composite tripwire cursor closed an equal-timestamp skip window; replacing a per-row full-event-log scan with an indexed lookup cut a clean 1,000-row page from 301.2534 seconds to 0.0351 seconds.

The same historical release made watchdog state durable: old findings outside the paging window retire once, failed delivery still retries, and an unchanged deadman state does not manufacture duplicate evidence. Those results describe the retired scheduled architecture, not the v0.4.1 default install.

Six v1 gates stand between the lake and a runtime.

The autonomy boundary is narrow on purpose.

When explicitly invoked, the core may reconcile its event projection, retrieve scoped context, expand exact sources, append evidence, record feedback, and close out a task. Optional companion packages contain local curation, audit, and diagnostics. None of those operations is scheduled by the default install, and none grants general authority.

• It does not enqueue or execute agent work.
• It does not install skills or ship packages.
• It does not enable hosted judgment or embedding merely because a credential exists or a preview passed.
• It does not export the training corpus to a hosted endpoint.
• It does not destructively delete the evidence ledger as ordinary maintenance.

The second fine-tune improved and still failed the model-quality bar.

Pilot two reused the first pilot's twenty prompts, references, rubric, held-out hashes, and blind randomization byte-for-byte. Eleven canonical first-party examples were added locally; ten cleared the unchanged 0.8 grade threshold. The same pinned base and trainer then ran for fifty steps, with validation loss moving from 2.648 to 2.359.

The original blind run used an automated 7/8 calibration preflight. On July 10, eight direct human decisions replaced those machine-authored expected winners as the calibration truth. v0.4 fixed the evaluator rubric without changing a label or lowering the 90% gate; the local Gemma judge passed 8/8. Calibration-only mode never opened the blind set, so the twenty model ratings and the 7-to-13 result were not rerun.

The candidate improved from 2 preferences to 7, while the reference won 13. Candidate voice fidelity rose from 2.25 to 3.05, and naturalness rose from 2.90 to 3.50. That is real corpus progress. It is still a model-quality failure.

The useful conclusion remains the same: the evaluation can reject a weak model before anyone starts believing its style is Jonathan's.

What could still be wrong.

• Judge calibration. The local judge passed 8/8 direct human labels, but eight decisions are still a small calibration set. New disagreement cases should expand the set instead of making the gate easier.
• Single-writer contention. The known long transactions are now bounded and measured, but SQLite still has one writer and new write-heavy stages need the same discipline.
• Feedback coverage. The frozen retrieval suite now measures relevance, citations, scope, negative probes, and injection probes. The harder live metric is whether agents report or conservatively infer what actually changed the result.
• Pilot-v3 corpus. The AI-delegated 150-item review found 67 pass / 83 fail. Those labels are remediation evidence, not named-human approval. Remediation, reminting, local regrading, a fresh stratified named-human audit, and separate operator authorization remain required.
• Acceptance durability. Fresh Codex, Claude Code, and OpenClaw processes passed again for v1.0.1 on July 13. Future releases must repeat the real round trip; a saved configuration or historical receipt is not enough for a later binary.
• v1 activation. The pointer is retained after three-client acceptance, but cutover remains reversible and the immutable v0 archive remains the audit source—not a hidden runtime fallback.
• Single-machine fragility. The corpus has no automatic off-machine backup because a backup widens the privacy surface. That remains an operator decision.
• Operator configuration. OpenClaw's own doctor still warns about plaintext operator credentials until a SecretRef provider is chosen. No credential or local config is part of the ocbrain repository or release.

Reproduce the source gate.

PYTHONPATH=src uv run pytest -q
uv run ruff check .
uv run --with-editable . python -m compileall src tests
git diff --check

Runtime proof commands and the model-driven acceptance prompt are in the install guide. The current architecture and pilot contract live with the source.